multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access as exploited in conjunction with CVE-2022-41974. Local users able to access /dev/shm can change symlinks in multipathd due to incorrect symlink handling which could lead to controlled file writes outside of the /dev/shm directory. This could be used indirectly for local privilege escalation to root.

...

CVE-2022-43254

GPAC v2.1-DEV-rev368-gfd054169b-master was discovered to contain a memory leak via the component gflistnew at utils/list.c...

Raspberry Robin Operators Selling Cybercriminals Access to Thousands of Endpoints

The Raspberry Robin worm is becoming an access-as-a-service malware for deploying other payloads, including IcedID, Bumblebee, TrueBot aka Silence, and Clop ransomware. It is "part of a complex and interconnected malware ecosystem, with links to other malware families and alternate infection...

Raspberry Robin worm part of larger ecosystem facilitating pre-ransomware activity

Microsoft has discovered recent activity indicating that the Raspberry Robin worm is part of a complex and interconnected malware ecosystem, with links to other malware families and alternate infection methods beyond its original USB drive spread. These infections lead to follow-on...

WS-2022-0451

Dev mode Path traversal in nuxt/framework. Dev mode Path traversal in nuxt/framework...

PT-2022-38149

Уязвимость функции i2sbus add dev модуля sound/aoa/soundbus/i2sbus/core.c звуковой подсистемы ядра операционной системы Linux связана с неправильным освобождением памяти. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...

Vice Society Hackers Are Behind Several Ransomware Attacks Against Education Sector

A cybercrime group known as Vice Society has been linked to multiple ransomware strains in its malicious campaigns aimed at the education, government, and retail sectors. The Microsoft Security Threat Intelligence team, which is tracking the threat cluster under the moniker DEV-0832, said the gro...

DEV-0832 (Vice Society) opportunistic ransomware campaigns impacting US education sector

In recent months, Microsoft has detected active ransomware and extortion campaigns impacting the global education sector, particularly in the US, by a threat actor we track as DEV-0832, also known as Vice Society. Shifting ransomware payloads over time from BlackCat, QuantumLocker, and Zeppelin,...

DEV-0832 (Vice Society) opportunistic ransomware campaigns impacting US education sector

In recent months, Microsoft has detected active ransomware and extortion campaigns impacting the global education sector, particularly in the US, by a threat actor we track as DEV-0832, also known as Vice Society. Shifting ransomware payloads over time from BlackCat, QuantumLocker, and Zeppelin,...

SUSE SLED15: kpartx / libdmmp-devel / libdmmp0_2_0 / libmpath0 / multipath-tools / etc (SUSE-SU-2022:3711-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3711-1 advisory. - CVE-2022-41973: Fixed a symlink attack in multipathd. bsc1202739 - CVE-2022-41974: Fixed an...

DEBIAN-CVE-2022-43044

GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a segmentation violation via the function gfisomgetmetaiteminfo at /isomedia/meta.c...

CVE-2022-43045

GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a segmentation violation via the function gfdumpvrmlsffield at /scenemanager/scenedump.c...

CVE-2022-43039

GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a segmentation violation via the function gfisommetarestoreitemsref at /isomedia/meta.c...

PT-2022-38085

Уязвимость функции wwan hwsim dev new модуля drivers/net/wwan/wwan hwsim.c драйвера сетевых устройств ядра операционной системы Linux связана с неправильным освобождением памяти. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...

Prestige Ransomware impacts transportation industry in Ukraine and Poland

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Prestige Ransomware is using already-gained ADMIN access to target organizations in Ukraine and Poland by deploying its payload. The activity has been associated with DEV-0960...

New Prestige Ransomware Targeting Polish and Ukrainian Organizations

A new ransomware campaign targeted the transportation and logistics sectors in Ukraine and Poland on October 11 with a previously unknown payload dubbed Prestige. "The activity shares victimology with recent Russian state-aligned activity, specifically on affected geographies and countries, and...

New “Prestige” ransomware impacts organizations in Ukraine and Poland

The Microsoft Threat Intelligence Center MSTIC has identified evidence of a novel ransomware campaign targeting organizations in the transportation and related logistics industries in Ukraine and Poland utilizing a previously unidentified ransomware payload. We observed this new ransomware, which...

New “Prestige” ransomware impacts organizations in Ukraine and Poland

The Microsoft Threat Intelligence Center MSTIC has identified evidence of a novel ransomware campaign targeting organizations in the transportation and related logistics industries in Ukraine and Poland utilizing a previously unidentified ransomware payload. We observed this new ransomware, which...

New “Prestige” ransomware impacts organizations in Ukraine and Poland

The Microsoft Threat Intelligence Center MSTIC has identified evidence of a novel ransomware campaign targeting organizations in the transportation and related logistics industries in Ukraine and Poland utilizing a previously unidentified ransomware payload. We observed this new ransomware, which...

New “Prestige” ransomware impacts organizations in Ukraine and Poland

The Microsoft Threat Intelligence Center MSTIC has identified evidence of a novel ransomware campaign targeting organizations in the transportation and related logistics industries in Ukraine and Poland utilizing a previously unidentified ransomware payload. We observed this new ransomware, which...